Add CI testing under sandboxed system

[strk]

We have a few bugs reported in sandboxed systems, like #5212, #5550 and likely #5545 so having proper CI coverage under those condition would be useful.

I've already pgextwlist in the build-test docker image, next we'll need a recipe to make use of that by CI.

​https://github.com/dimitri/pgextwlist.git

[strk]

I've added preconfiguration of pgextwlist in the docker image, and granted postgis_reg_unprivileged_user user db creation privileges with ​https://git.osgeo.org/gitea/postgis/postgis-docker/commit/b6a836fd3421b15bd272dfc9f257cddbc7e24e5f

Once the image build completes ( ​https://debbie.postgis.net/view/PostGIS/job/PostGIS-docker/52/ ) we can experiment with using the unprivileged user for testing.

[strk]

Docker image is ready, work in progress pull request to use an non-superuser account to run tests is in ​https://git.osgeo.org/gitea/postgis/postgis/pulls/158

[strk]

As I found out empirically, "test using non-superuser account" is too generic: only EXTENSION based tests can run as non-superuser when using pgextwlist (and maybe in the future "trusted" extension - see #5567)

So we need SUPERUSER for script based and can use another role for extension based (if the target database setup allows for that). Maybe a run_test.pl switch could request using a special role for extension via a --extension-test-role or something along those lines.

[strk]

I've settled for a POSTGIS_REGRESS_ROLE_EXT_CREATOR environment variable support in run_test.pl which landed in the master branch with [52bfcd5faa3a7577292814d0a5a17c5698a9032f/git]

In ​https://git.osgeo.org/gitea/postgis/postgis/pulls/158 I'm experimenting with that.

[Sandro Santilli <strk@…>]

In 5739cacd/git:

run_test.pl: add POSTGIS_REGRESS_DB_OWNER env support

Allows specifying a DB role to be given ownership of the regress
database and be used to create extension of POSTGIS_REGRESS_EXT_CREATOR
is not also provided to override that.

References #5212
References #5566
References #5567

[Sandro Santilli <strk@…>]

In b2ee709/git:

run_test.pl: add --after-create-db-script support

This can be used to configure target database, for example to
enable/configure pgextwlist

References #5566

[strk]

CI is failing due to our own script refusing to package functions owned by a different owner than the extension owner: ​https://woodie.osgeo.org/repos/30/pipeline/1441/4#L5492

Should we relax that check and accept mixed ownership as long as the owner of existing function is a superuser ?

[strk]

The ownership check was implemented in commit [06f49e8dc83cfd7319709518ba479a3fd95e5000/git] referencing #4648

[Sandro Santilli <strk@…>]

In 85395aa/git:

run_test.pl: use db ext creator for upgrading too

References #5566

[Sandro Santilli <strk@…>]

In e2bf40c/git:

Set ownership of packaged functions to extension owner

Still check that the functions were owned by a superuser.

References #4648
References #5545
References #5566

[Sandro Santilli <strk@…>]

In 5c37f97/git:

[woodie] Test with unprivileged user under pgextwlist

Closes #5566